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Abstract — One of the key methods of ensuring effectiveness and 
actionability of military intelligence is “Red Teaming”. Red 
Teaming involves questioning the conventional analyst-driven 
military intelligence constructs. This paper proposes a new Red 
teaming approach based on Neutrosophic Cognitive Mapping, 
that helps combine various multi-disciplinary intelligence inputs 
in a non-linear and complex manner. Such an approach is used to 
cross-verify the conventional analyst constructed causalities of 
military threats. The approach is demonstrated with the help of 
an example on the perceived existence of a common national 
security threat-a suspected impending terror attack. Red teaming 
the intelligence that warns of this threat is achieved by 
objectively casting the maze of causalities as suggested by five 
military intelligence agencies in appropriate Neutrosophic 
Cognitive Maps and combining them in an integrated manner. 

Keywords- military intelligence , red teaming , neutrosophic 
cognitive maps 

I. Introduction (Heading 1 ) 

Military Intelligence (MI) is an omnipresent component of 
a nation’s security. History is witness to the fact that many 
wars have been won and many national security threats have 
been identified and action taken depending on actionable 
intelligence received in time. However, intelligence failures as 
evidenced in the 9/11 terror attacks in the U.S. or the 26/11 
terror attacks in Mumbai have highlighted the need for 
questioning existing analytic methods of MI. In this context, 
various intelligence experts have emphasized the need for more 
effective “Red Teaming”. For example, as mentioned in the 
United States National Intelligence strategy 2009 [1], 

“Expanded use of techniques such as red-teaming can help 
ensure quality and integrity in analytic products, and 
potentially produce fresh insights into our toughest 
challenges”. 

Red Teaming is defined as: “structured, iterative process 
executed by trained, educated and practiced team members that 
provides commanders an independent capability to 
continuously challenge plans, operations, concepts, 
organizations and capabilities in the context of the operational 
environment and from our partners’ and adversaries’ 
perspectives” [2]. Though this definition looks limited to field 
operations, over time, the notion of red teaming has expanded 
to challenge analyst constructs covering all spheres of MI and 
not just limited to operational battle-field level intelligence. 
Red teaming is essential to help MI analysts and Decision- 



makers avoid surprise and overcome cognitive biases by 
considering problems from a contrarian point of view. 

A person who follows the profession of Red teaming is 
known as a “Red teamer”. 

II. Military Intelligence (MI) - current methods 

MI comprises of mainly 6 subcomponents: Strategic 
Intelligence (STRATINT), Imagery Intelligence (IMINT), 
Tactical Intelligence (TACINT), Human Intelligence 
(HUMINT), Counter Intelligence (Cl), Signals Intelligence 
(SIGINT) [3]. Various MI analytical methods are used to 
manipulate intelligence information with a view to providing 
timely and actionable intelligence to the decision-makers. The 
effectiveness of these methods is dependent on whether or not 
the analysts and their models have managed to identify the 
causal connections between events and intentions as discerned 
from unsupervised intelligence data correctly. The fact that 
often times the underlying intelligence data is unavoidably 
incomplete, inadequate or hazy makes the task even more 
challenging. 

A. Current Analytical Methods employed in MI 

Multitude of analytical methods is used in the context of 
military intelligence. They range from simple methods such as 
activity/event flow charts to relatively complex methods such 
as ONA (Operational Net Assessment) and computational 
approaches. Understandably, these approaches are under 
continuous research and updation. Constraints of space prohibit 
a discussion of all of these methods; however two analytical 
approaches are discussed in brief detail: ONA and Disciple- 
LTA. ONA is an approach that is widely practiced in this field 
and Disciple -LTA (cognitive assistant) is a proposed 
(research) approach. 

Operational Net Assessment (ONA): The ONA is a ’’nodal 
analysis,’’ which looks at the adversary as a ’’system of 
systems,” looking at not only his military capabilities, but also 
political, economic, and social factors, and information systems 
and economic infrastructure. Included in this assessment, is a 
look at the battle space, capabilities, and enemy’s perceptions 
about the (analyzing) country. This assessment is used to 
provide a clear pointer to the kind of effects the (analyzing) 
country wants to achieve. The means to generate the desired 
effects are not limited to military ones, but can include 
diplomatic, information, and economic means, as well. The 
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desired effects are used to design an "effects-based” operation; 
and ’’decision superiority” means being able to make decisions 
faster than the enemy. All of this, employed together, is 
supposed to result in the execution of a "rapid, decisive 
operation [4].’’ 

Disciple-LTA: This is a cognitive assistant that helps 
intelligence analysts evaluate the likelihood of hypotheses by 
developing Wigmorean probabilistic inference networks that 
link evidence to hypotheses in argumentation structures that 
establish the relevance, believability and inferential force or 
weight of evidence [5]. 

Any decision-making pertaining to MI has to take into 
account diverse inputs flowing out of many different analyst 
methods. The conventional analyst supported methods as above 
have many disadvantages, some of which are listed below: 

i) A major weakness in contemporary intelligence 
community is perceived to be its difficulty in providing 
strategic intelligence— the comprehensive overviews that put 
disparate events and the fragmentary snapshots provided by 
different intelligence sources into a contextual framework that 
makes it meaningful for the intelligence consumer. This 
criticism applies to intelligence prepared both for a national 
policy audience and for more specialized audiences, such as 
battlefield commanders [6]. 

ii) Ways in which the intelligence is disseminated and used 
by the end customers (analysts) differ. For example, in the case 
of SIGINT, after collecting a signal, the NS A (National 
Security Agency of USA), analyses it, produces information 
and then distributes this information to a variety of customers 
and agencies. However in the case of IMINT, an image 
obtained is sent to a variety of organizations and is subject to 
their interpretation. Naturally, this leads to a possibility of 
non-standard interpretations of the same intelligence data, 
which when input into different Decision Making models will 
produce diverse output. 

iii) Cl is an essential part of MI. However Cl is often the 
most arcane and organizationally fragmented, the least 
doctrinally clarified, and legally, and thus politically, the most 
sensitive intelligence activity [7]. Thus due to the difficulties 
involved in gaining Cl, information from Cl can be incomplete, 
inadequate, and even misleading if the enemy is a master in 
deception. Conventional analytical models largely depend on 
the world-view of the analyst when factoring in such 
information into decision-making models. 

Despite knowing the limitations of the conventional MI 
analytic methods as above, Red Teamers have to combine all 
the 6 sub-components of MI (as mentioned earlier in this 
section) in a complex and non-linear manner in order to 
effectively challenge conventional analyst constructs. Various 
Red teaming methods are currently in use -they are briefly 
described below 

B. Red Teaming Methods 

Historically Red Teaming formats have included Red 
teamers playing the role of a “devil’s advocate” by a simple 
vulnerability analysis, proposing alternative hypotheses, war 



games and simulation etc. [8]. Key analytical techniques used 
by Red teamers are [9] : 

Key assumptions check, Quality of information check 
Indicators or signposts of change track, Deception detection 
Analysis of Competing Hypothesis, Devil’s advocacy, Team 
A/Team B contrarian technique, High-Impact/Low-probability 
Analysis, What-if Analysis, Brain storming, Outside-in 
Thinking, Surrogate Adversary/Role Play, Alternative Futures 
Analysis 

Red Teamers are exhorted to challenge constructs of 
intelligence analysts and ask the “right” questions while at the 
same time reminded that (military) decision making is heavily 
dependent on experience and instinct [10]. Surprisingly though, 
despite the complexity of their tasks, much of the red teaming 
exercises are done in a conventional way-they are heavily 
people dependent and demonstrate scope for benefitting from 
computational/ cognitive approaches. 

To some extent researchers have claimed that existing 
techniques (e.g. Disciple-LTA mentioned above) can help with 
certain methods of red teaming -e.g. ACH -However there 
exists no tool that can provide a comprehensive direction to the 
red teamers who struggle with discerning causalities from 
multi-disciplinary intelligence data that is often times 
incomplete, indeterminate and inadequate for purposes of 
causal analysis. In summary, they need a robust method to put 
disparate and multi-disciplinary intelligence data pertaining to 
the 6 components of MI into a common framework that can 
afford both flexibility as well as analytical rigor. 

What type of tools would be conducive to Red teaming? A 
key characteristic of a good Red teamer is being a good causal 
analyst. Several causal analytic tools are available currently; 
however dealing with complex systems involving 
indeterminate causal relationships require specific tools that 
address this situation. 

One such tool is proposed in this paper based on the 
methodology of Neutrosophic Cognitive Maps developed by 
W.B.V.Kandasamy and F.Smarandache [11]. 

III. USING NEUTROSOPHIC COGNITIVE MAPS TO REPRESENT 
RED TEAMING PROBLEM 

First a brief background about cognitive maps in general is 
discussed followed by key features of Neutrosophic Cognitive 
Mapping. 

A. Neutrosophic Cognitive Maps 

A recent advance in the field of cognitive maps is 
Neutrosophic Cognitive Maps. This is based on neutrosophic 
logic created by Florentine Smarandache, which is an 
extension / combination of the fuzzy logic in which 
indeterminacy is included. A Neutrosophic Cognitive Map 
(NCM) is a neutrosophic directed graph with concepts like 
policies, events etc. as nodes and causalities or indeterminates 
as edges. It represents the causal relationship between 
concepts. A key difference between Fuzzy Cognitive Maps 
(FCM) and Neutrosophic Cognitive maps is that Neutrosophic 
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maps permit the relationship of “indeterminacy” between 
nodes which is not possible to perform in a FCM. Given the 
discussion in Section II above on the need to incorporate 
indeterminate relationships in causal analysis, NCM is a very 
useful way of causal representations for MI, especially for the 
Red teamers. 

Some of the essentials pertaining to NCM are listed [12]: 

i) Let Ci and Cj denote the two nodes of the NCM. The 
directed edge from Ci to Cj denotes the causality of Ci on Cj 
called connections. Every edge in the NCM is weighted with a 
number in the set {-1, 0, 1, I}. Let eij be the weight of the 
directed edge CiCj, eij ^ {-1, 0, 1, 1}, eij denotes the strength 
of causality, eij = 0 if Ci does not have any effect on Cj, eij = 1 
if increase (or decrease) in Ci causes increase (or decreases) in 
Cj, eij = -1 if increase (or decrease) in Ci causes decrease (or 
increase) in Cj . eij = I if the relation or effect of Ci on Cj is an 
indeterminate. 

ii) Let Cl, C2,...Cn be n nodes of the NCM. Let S = 
(sl,s2,...sn) where si belongs to {0,1,1}. S is called the 
instantaneous state neutrosophic vector and it denotes the on- 
off-indeterminate state position of the node at an instant. 

si=0 if si is off (no effect) 

si=l if si is on (has effect) 

si=I if si is indeterminate (effect cannot be determined) for 
i=l,2,...n 

iii) If the equilibrium state of a dynamical system is a 
unique state vector, then it is called a “fixed point”. If the NCM 
settles with a neutrosophic state vector repeating in the form S 1 
— > S2 — — ► Si — ► SI, then this equilibrium is called a limit 
cycle of the NCM. 

iv) Let Cl, C2,..., Cn be the nodes of an NCM, with 
feedback. Let E be the associated adjacency matrix. The 
“hidden pattern” is found as follows: When Cl is switched on, 
an input is given as the vector SI = (1, 0, 0,..., 0) and the data 
passes through the neutrosophic matrix N(E). This is done by 
multiplying A1 by the matrix N(E). 

Let S1N(E) = (si, s2,..., sn) with the threshold operation 
that is performed by replacing si by 1 if si > k and si by 0 if si < 
k (k - a suitable positive integer) and si by I if si is not an 
integer. The resulting concept is updated and the concept Cl is 
included in the updated vector by making the first coordinate as 
1 in the resulting vector. Suppose S1N(E) — ► S2 then consider 
S2N(E) and repeat the same procedure. This procedure is 
repeated till a “limit cycle” or a “fixed point” is obtained. (— ► 
stands for vector thresholding and updation). 

v) Finite number of NCMs can be combined together to 
produce the joint effect of all NCMs. If N(E1), N(E2),..., 
N(Ep) be the neutrosophic adjacency matrices of a NCM with 
nodes Cl, C2,. . ., Cn then the combined NCM is got by adding 
all the neutrosophic adjacency matrices N(E1),..., N(Ep). We 
denote the combined NCMs adjacency neutrosophic matrix by 
N(E) = N(E1) + N(E2)+. . .+ N(Ep). 



IV. USING NEUTROSOPHIC COGNITIVE MAPS TO REPRESENT 

RED TEAMING PROBLEM 

A. Red Teaming problem construction 

Red teaming problem definition: Consider a national 
security threat e.g. Impending Terror attack. Information on 
such issues is gathered and analyzed by 5 different MI agencies 
Al, A2,...A5. Based on intelligence data gathered, MI analysts 
with these agencies process the information differently and 
provide intelligence inputs which are sometimes disparate and 
not in tandem with each other. The offshoot is that some 
agencies believe there is a cause for concern regarding a 
perceived impending terror attack whereas others believe it is 
not the case. Under such circumstances, how can the Red 
teamer review all of that MI information and arrive at a 
definitive conclusion as to whether or not there is indeed a 
cause for concern regarding an impending terror attack? 

B. Red Teaming Solution construct using NCMs 

The first task of the Red teamer is to classify the 
intelligence information received from various agencies under 
major categories. In this paper it is assumed that he/she places 
all MI data received under the 6 categories of intelligence as 
discussed before: STRATINT, IMINT, TACINT, HUMINT, 
CI and SIGINT. 

These intelligence concepts that contribute causal evidence 
to the national security threat are labeled C2, C3...C7 - 
whereas their suspected effect viz. the impending terror attack 
is labeled as Cl. Based on the techniques as described in the 
section above, the Red teamer can arrive at an edge value of eij 
£ {-1, 0, 1,1} between concepts Ci and Cj, where eij denotes 
the strength of causality, eij = 0 if Ci does not have any effect 
on Cj, eij = 1 if increase (or decrease) in Ci causes increase (or 
decreases) in Cj, eij = -1 if increase (or decrease) in Ci causes 
decrease (or increase) in Cj . eij = I if the relation or effect of 
Ci on Cj is an indeterminate. 

NCMs are constructed for the Red teamer’ s assessment of 
causal relations as proposed by the various agencies. E.g., 
Agency Al may, based on Strategic Intelligence obtained 
through diplomatic channels, say that state supported terrorism 
situation of a target country is currently not causal to a situation 
of an impending terror attack in the (analyst) country. However 
another agency A5 can actually come up with a piece of 
counter-intelligence that they suspect (but can’t conclusively 
prove) that lot of government misinformation and 
misrepresentation is in vogue in the target country rendering 
state-sponsored terrorism as suspected to be prevalent which 
may cause a terror attack in the (analyst) country. On the basis 
of Al, the Red Teamer will assign 0 to the edge relation of 
STRATINT-IMPENDING TERROR ATTACK in Al’s NCM 
whereas he/she will assign the value I to the edge relation CI - 
IMPENDING TERROR ATTACK in the NCM of A5. 

C. Concept definition for Red Teaming NCMs 

• Impending Terror Attack (Cl) : Imminent Terrorist 
attack on the (analyst) country 
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• Strategic Intelligence (STRATINT - C2): This is “the 
Intelligence that is required for the formulation of 
strategy, policy, and military plans and operations at 
national and theater levels” [13]. Intelligence 
information about the causal strategic capabilities and 
intentions of target country in initiating a terrorist 
attack in the (analyst) country is included here [14]. 

• Imagery Intelligence (IMINT - C3): This is a means 
of obtaining information about distant topics by 
creating an image of it, most often using visible light 
photography [15]. Images that may lead investigators 
to believe that there is an imminent terrorist attack in 
the (analyst) country would be included here. 

• Tactical Intelligence (TACINT - C4): This is the 
(battle field) intelligence required by the commander 
to provide a basis for planning and conduct of tactical 
operations. It deals with the local tactical situation, 
particularly with the environment and threat 
[16]. Ground level intelligence obtained as pertaining 
to the activities of the target country (especially in the 
analyst country) can provide causal connections to 
the perception of an imminent terrorist attack. 

• Human Intelligence (HUMINT - C5): This is derived 
from human sources. HUMINT collection is 
performed by overt collectors such as diplomats and 
military attaches in addition to covert collectors such 
spies and undercover agents. Collection includes 
clandestine acquisition of photography, documents, 
and other material; overt collection by personnel in 
diplomatic and consular posts; debriefing of foreign 
nationals and US citizens who travel abroad; and 
official contacts with foreign governments [17]. The 
human intelligence that points towards causal 
evidence of moves towards an imminent terror attack 
in the (analyst) country will be considered here. 

• Counter Intelligence (Cl - C6): This is the study of the 
organization and behavior of the intelligence services 
of foreign states and entities, and the application of 
the resulting knowledge [18]. Cl forms an important 
part of providing crucial information on imminent 
terror attacks in the analyst country. 

• Signals Intelligence (SIGINT - C7): The interception 

of foreign signals provides data on a nation's 
diplomatic, scientific, and economic plans or events as 
well as the characteristics of radars, spacecraft and 
weapons systems. Such intelligence is called Signals 
Intelligence (SIGINT) - this can be further broken 
down into five components: communications 

intelligence (COMINT), electronics intelligence 
(ELINT), radar intelligence (RADINT), laser 
intelligence (LASINT), non-imaging infrared 
[19] .However, for purposes of this paper, SIGINT 
would be considered as one consolidated concept 
which provided pointers to the causation of conditions 
conducive for an impending terror attack. 

It is important to note that the above intelligence 

classifications are based on the nature of MI information and 



not source/format based. E.g. Cl will involve imagery, 
TACINT will involve signal processing but nevertheless, 
image based intelligence will be considered under IMINT and 
signal processing output would be considered under SIGINT. 

In this paper, the red teamer’ s assessment of each Agency 
Ai’s causal intelligence data would be discussed in light of the 
6 intelligence concepts (C2-C7) as articulated above. 

D. Red Teaming NCMs 

The following are the NCMs framed by the Red teamer 
post receiving inputs from the five agencies. Note that these 
NCMs do not reflect the causality perceptions of the agencies 
themselves-this would have been already captured in their 
intelligence reporting -but reflect the causality assessment of 
the Red Teamer post reviewing the intelligence reporting from 
the five agencies. 






Figure 3. NCM pertaining to Agency 3 (A3) 
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The Neutrosophic adjacency matrices pertaining to the above 
are given below: 
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Note: N(A) is the combined Neutrosophic adjacency matrix 
pertaining to all the agencies 



Applying the state vector Vi=(l 0 0 0 0 0 0) on the state of 
Node Cl, we obtain the effect of Vi on N(E) as 

V!N(E) = (0 1 0 1 1 0 1)->(1 1 0 1 1 0 1) = V 2 

Where the symbol — > stands for vector thresholding and 

updation is based on k=l as per rules specified in section 

3.2(iv). 

V 2 N (E) = (8+51 1 0 -3 1 21 1) -► ( 1 1 0 0 1 1 1) = V 3 
V 3 N (E) = (5+21 1 0 -3 1-1 21 1+21 ) — ► ( 1 1001I1) = V 4 
V 3 = V 4 : Fixed point reached. 

V. RESULTS AND DISCUSSION 

The findings show the Red teamer that: 

On an overall basis, the concern about the existence of an 
impending terror attack is not unequivocally borne out by 
intelligence gathered so far. The concern is justified by 
STRATINT, HUMINT and SIGINT-However IMINT and 
TACINT are not supportive of that concern. In addition, Cl 
based information, which is an important driver of conclusions 
regarding terrorist threats, is ultimately “Indeterminate”. This 
tells the Red Teamer that he/she has to get back to all agencies 
Al, A2,...A5 with specific requests for more information 
gathering on Cl and repeat the process of NCM construction 
and analysis as above. Assume that post revising the causal 
assessments after receiving additional information the new 
final thresholded vector is V” = ( 1 1001 1 1) (The NCM 
method applied on revised data being the same as illustrated in 
Section V ). The Red Teamer can conclude that since 4 out of 6 
intelligences suggest existence of an intended terror attack, 
there is indeed a cause for concern. There could be other 
approaches to analyzing the results. One such approach 
consists of attaching simple weights to the various intelligences 
based on their relevance and importance to decision making. 
Such an approach is especially useful if the revised thresholded 
Vector V” displays a tie in the number of concepts suggesting 
causality of the imminent terror attack. 

Weighted Method: Let V” - ( 1 100101) In this case 
there is a tie between the intelligence inputs. Three of the 
intelligences suggest that terrorist threat exists but other three 
suggest that the threat is not justified on the basis of available 
intelligence. In this case the Red Teamer adopts a simple 
weighted approach where in each of the intelligences can be 
assigned weights. 

E.g. C2 - 20%, C3- 20%, C4 -10%, C5-30%, C6-10%, 
C7=10% 

The on off state for each Concept in V” leads to a weighted 
average score of (20+30+10)/100 = 60% which tends towards 
existence of the threat (since this is >50%, the point of no 
difference). 

Some of the advantages of the above proposed method for 
Red Teaming using NCM are: 

• Complex non-linear representation and computation 
of causal intelligence involved in the MI problem. 

• Flexibility to include multi agency intelligence inputs 
on the same platform. 
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• No imposed pre-designed analyst influenced criteria 
for red teaming thereby facilitating emergence of 
hitherto unidentified knowledge patterns. 

• Inclusion of indeterminate causalities which is 
particularly necessary given the incomplete nature of 
intelligence information. 

• The ability to seamlessly combine multi-agency 
opinion, taking advantage of the fact that NCMs are 
additive in nature. 

There is scope for further research on the above Red 
Teaming solution construct especially with regard to 
systematically challenging underlying MI analyst assumptions 
and quality of MI information using Neutrosohpic subgraphs. 

VI. CONCLUSION 

Red teamers are tasked with challenging conventional 
analyst constructs on Military Intelligence issues. However 
Incomplete/indeterminate intelligence data pertaining to threat 
event causalities make their task difficult. This paper discussed 
a new method based on Neutrosophic Cognitive Maps to Red 
team Military Intelligence findings. The method helps Red 
teamers to objectively discern causalities from multi-agency 
intelligence inputs using a non-linear approach and also allows 
the flexibility to integrate “indeterminacy” in intelligence data 
processing. The overall approach was demonstrated using an 
example of a hypothetical concern for existence of an 
imminent terror attack on the (analyst) country. 
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